Security Guidelines
Saxo Capital Markets has a strong commitment to information security. To meet our high level of security standards as well as those of the legal bodies regulating our business sector, Saxo Group places a strong emphasis on securing the trading platforms that our clients use. Even with this diligent effort in place, you must be aware of what you can do to maintain as well as increase the security of your trading platform – your PC.
2FA Risk Awareness Statement
What is 2FA?
2FA (also known as 2-factor authentication) is the verification of a user’s online identity using two distinct factors.
The current practice used by financial institutions in Singapore and Australia is to require clients to go through a 2-factor authentication process – a Personal Identification Number (PIN), which is issued by the financial institution will be generated from an Authenticator installed on a smartphone.
This is also a security function that is available to clients of Saxo Capital Markets Pty Ltd (“SCM”). When a SCM client who has elected to participate in 2FA wishes to access an online service provided by SCM, the client is required to enter the PIN and the OTP for authentication.
The 2FA login process deployed by SCM is described in further detail here:
Clients who register for 2FA enjoy the added security layer when accessing their trading accounts online.
What is the purpose of 2FA?
The key objectives of 2FA are to protect the client’s online trading account and information from unauthorized access, and enhance the overall security of online trading systems. SCM takes a proactive role in protecting our clients. We have risk mitigating measures in place to protect your online trading account and information from unauthorized access. Should you require assistance, please contact SCM for more details.
Is 2FA compulsory for trading through SCM?
2FA is not compulsory for trading via SCM. Nonetheless, clients are strongly encouraged to use 2FA on their online trading accounts. Clients that elect to use 2FA for login will be required to provide both password and OTP to access the online trading services. Clients should exercise due care to safeguard their password and OTP, and not disclose them to other parties.
What if I choose not to use 2FA for trading through SCM?
In general, single-factor password authentication is more susceptible to password-based attacks and malware that could result in the compromise and hijacking of online trading accounts by unauthorized parties. This could in turn lead to unauthorized disclosure of your personal and trading information that may be available on the online trading account, or the carrying out of fraudulent trades through your online trading account. Choosing not to use 2FA for the online trading account would increase your exposure to these risks.
How can I protect myself if I choose not to use 2FA for online trading through SCM?
You should observe the following practices to secure the confidentiality and integrity of your password and PIN (for funds transfer), personal details and other confidential data as far as possible. These will help to prevent unauthorised transactions and fraudulent use of your accounts and make sure that no one else would be able to observe or steal your access credentials or other security information to impersonate them or obtain unauthorised access to your online accounts:
You should:
- Take the following precautions as regards your PIN and password (“credentials”);
- Credentials should be at least 8 characters of alphanumeric mix;
- Credentials should not be based on guessable information such as user-id, personal telephone number, birthday or other personal information;
- Credentials should be kept confidential and not be divulged to anyone;
- Credentials should be memorised and not be recorded anywhere;
- Credentials should be changed regularly or when there is any suspicion that it has been compromised or impaired; and
- The same PIN should not be used for different websites, applications or services, particularly when they related to different entities,
- Not select the browser option for storing or retaining user name and password
- Check the authenticity of our website by comparing the URL and our name in its digital certificate or by observing the indicators provided by an extended validation certificate;
- Check that the website address changes from ‘http://’ to ‘https://’ and a security icon that looks like a lock or key appears when authentication and encryption is expected;
- Check your account information, balance and transactions frequently and report any discrepancy;
- Install anti-virus, anti-spyware and firewall software in your personal computers and mobile devices;
- Update operation system, virus and firewall products with security patches or newer versions on a regular basis;
- Remove file and printer sharing in computers, especially when they are connected to the internet;
- Make regular backup of critical data;
- Consider the use of encryption technology to protect highly sensitive or confidential information;
- Log off each and every online session;
- Clear browser cache after each and every online session;
- Not install software or run programs of unknown origin;
- Delete junk or chain emails;
- Not open email attachments from strange or untrustworthy senders;
- Not disclose personal, financial or credit card information to little-known or suspect websites;
- Not use a computer or a device which cannot be trusted; and
- Not use public or internet café computers to access online services or perform financial transactions
Read more about Security Guidelines
Do you know who is calling?
Appearances are not always what they seem to be. You should always be somewhat sceptical if you are contacted by phone, mail or otherwise with unusual requests or offers that are too good to be true. Who can it be?
Unknowingly passing on confidential information to the wrong person can have dire consequences. Imagine giving your SaxoTrader account details directly to a thief while believing that you are talking to a Saxo Group employee.
Social engineering is the act of manipulating a person to unknowingly divulge confidential information, e.g. by imposing as a trusted professional wanting to assist with a specific issue. A person performing social engineering will collect information about you leading you to believe they are to be trusted.
By following the guidelines below, you will minimise the risk of being the victim of a social engineering attack:
- Never divulge confidential account details or similar information to anyone, neither verbally nor in writing. You will never be asked to do so by a Saxo Group employee.
- Be sceptical of unusual calls by persons posing as Saxo Group support staff or as a substitute for your regular advisor at Saxo Group.
Is your computer vulnerable to attack?
The majority of attacks, whether these are by viruses or hackers, take advantage of software that has not been updated appropriately. Learn how you with a few clicks can make sure that you are not among the first to be hit.
A computer that is not updated with current software can provide easy access for a targeted attacker or virus outbreak. An attacker with full access to your computer can potentially perform transactions on your behalf.
Hackers and creators of viruses exploit known vulnerabilities in software that is not up to date. Typically, an attacker will scan the Internet to detect systems displaying known vulnerabilities, drilling down on these subsequently.
- Ensure that all software on your computer is up to date by using the computer’s update functionality. In particular, your operating system and your browsers should be prioritised (MS Windows Update or Software Update on Mac OS).
- Use antivirus software to protect against malware. Make certain to have the update functionality enabled.
- Enable the personal firewall on your computer
Is someone else trading in your name?
It is a common human tendency to re-use passwords across different accounts (e.g. webmail, social networking site, as well as the Saxo Group account). Learn why this is poses a serious threat and how you can make unique and secure passwords… If someone has access to your user account details, they will be able to perform transactions in your name.
A common tendency is to reuse passwords on different sites in order to minimise the number of passwords that we have to remember. If you are reusing your SaxoTrader password on less secure sites that are compromised by an attacker, the attacker will be able to gain access to your account and perform transactions in your name.
By following the guidelines below, you minimise the risk of your password being stolen:
- Use different passwords on different sites.
- There exists a number of different password management tools to handle your passwords.
- If you must reuse passwords, then create them in different complexity levels: complex passwords for net-banking and trading applications; less complex passwords for sites where the consequences of a compromise are lower.
- Make complex passwords consisting of a minimum of 8-10 alphanumeric characters as well as special characters. A simple technique for creating complex passwords is to make a sentence that you can remember and use the first letters of each word and vary the use of lower case and upper-case characters. This may seem difficult at first glance but is actually relatively simple:
- I will have a great Hair Day: Iwm@g8HD
- Change your complex passwords on banking sites at least every three months.
Should you suspect any irregularities, please contact us immediately.